A digital privacy infrastructure built for the future.
USA
Joined August 2025
- Tweets219
- Following8
- Followers3.9K
- Likes148
$ENX Liquidity Lock has been extended for an additional year.
etherscan.io/tx/0x1fe305d5ab…
Updates on Enigma and Developments from our Founder, Harris Nussbaum!
September 21st @ 4 PM EST.
xitter.gq/i/spaces/1qxoNYmjXDEJv
the fight against privacy is happening in real time.
we're here to protect it.
$ENX
this is absolutely insane
- the UK now proposes scanning of all PRIVATE content on user devices or *jail* (for the execs) of device companies
^ recall how the french already arrested pavel earlier this year
- this is on a *device level* -- meaning you can not even use the phone freely *unless you literally KYC* -- does not matter which apps you use
- on top of this, they will require *another* KYC submission on the app-level to access certain apps
so this would mandate both device-level and app-level surveillance
this is the most draconian shit I have seen in tech yet
Network Reachability for Autonomous Agents
Banks are beginning to run AI agents against their own systems: software that holds delegated credentials and acts with some autonomy across internal services.
An agent can enumerate services, attempt connections, and move between hosts at a rate no analyst matches.
A security operations center evaluates this activity after the traffic reaches it. RAVID operates earlier, at the network layer that determines whether an agent can reach a service at all.
RAVID is identity-driven microsegmentation delivered as a software overlay. Microsegmentation means reachability between endpoints is controlled per connection rather than by broad network zones. An overlay is a software-defined layer that runs above the existing IP network. On that overlay, each user, agent, device, and service is addressed as a cryptographic identity - an endpoint authenticated by a credential rather than located by an IP address.
Agents are enrolled as identities, not as users issued API keys. The overlay operates default-deny: a service is not resolvable to a requester, and accepts no connection from it, until the requester authenticates and the specific connection is authorized. An agent that has not satisfied both conditions has no route to the service, and the service is not resolvable to it.
This model governs which services an agent can reach. It does not govern what an agent does once a connection is authorized, and it does not address application-layer logic or the misuse of a credential that policy currently permits. Behavioral control over an authorized agent is a separate concern, which Enigma addresses with the AI Killswitch; RAVID covers the network-reachability portion of that control.
Where the model contributes directly is containment. Because connection policy and network reachability are evaluated in one plane, revoking an identity ends its authorization and its connectivity at the same time. There is no interval in which permission has been withdrawn but a route still exists. For an agent showing unexpected behavior, revocation removes its reachability across the overlay in a single action rather than through firewall changes applied host by host.
$ENX
Development Update
A short status on current work.
EPN Beta:
EPN - session-scoped, non-routable private network connectivity - is close to launch towards community beta. We’re targeting June, gated by the current review pass.
Security review:
An independent group is running penetration testing against the current build and feeding findings back into development. Resolving findings is the condition for opening the beta.
User testing:
A small testing cohort is being added this week to cover usage under varied network conditions. We’re also opening this to the community: beta testers who can exercise the build and report back will help, and we’ll post details on how to participate alongside the beta.
Integrations:
Integration and evaluation discussions are underway with several partners, including a deployment to a self-healing datacenter operator. We’ll describe each in more detail once the technical scope is confirmed and disclosable.
Next step is an internal sync before the next round of testing and deployment.
Open Source Agentic AI: Architecture, Exposure and Infrastructure Constraints 🧵
Between December 2025 and February 2026, a single attacker breached nine Mexican government agencies using publicly available agent frameworks - 415 million records exposed. That same month, 42,000+ OpenClaw control panels were found publicly accessible across 82 countries, with a misconfigured database leaking 1.5 million authentication tokens. IBM puts average breach costs in AI-heavy organizations at $4.88M per incident. Post-incident analysis found 78% of compromised agents had broader permissions than their function required.
These incidents share common architectural properties: broad default permissions, insufficient component isolation, persistent network exposure. What follows examines those properties and where infrastructure design can reduce ambient risk - and where it cannot.
(5/6) Where RAVID and EPN reduce structural exposure
RAVID constructs communication paths dynamically and rotates them over time. Under a passive network-level threat model, this reduces accumulation of stable routing identifiers that can be correlated across sessions. Authentication and policy evaluation occur before connectivity is established - control interfaces are not reachable by unauthenticated parties by default.
EPN extends this with non-routable, session-scoped connectivity. Agent dashboards and internal APIs can operate without public network presence. Sessions can be time-bounded and rotated, limiting how long a captured credential or observed metadata pattern remains actionable.
Neither system addresses poor secret management, unsafe agent logic, or flawed objective specification.
(6/6) Conditions and limitations
Active endpoint compromise, malicious plugin injection, supply chain attacks, and behavioral failures in agent decision-making fall outside what network and identity layer infrastructure can address. Code audits, secret hygiene, strict permission scoping, and input validation remain necessary independent of network architecture.
The incidents of the past 18 months reflect overlapping weaknesses - architectural, operational, and behavioral - that compounded over time. Reducing structural exposure at the network layer narrows one part of the attack surface under a defined set of conditions. Enigma’s current work addresses the network and identity layers. Scope and design assumptions are documented in the RAVID and EPN technical references.
End of thread.
$ENX
Three months after the European Parliament Think Tank published “Virtual private networks and the protection of children online”(europarl.europa.eu/thinktank…), the regulatory direction it outlined is becoming concrete.
The briefing framed VPNs primarily as a child safety risk and proposed restricting access by age. Measures now advancing through legislative channels follow that logic directly - using child protection to justify policies that weaken general-purpose privacy infrastructure.
Here is our review:
The Policy Case Against VPNs - and What It Gets Wrong
A recent European Parliament briefing presents growing VPN usage as a child safety issue. It cites increased VPN downloads after the UK’s Online Safety Act and France’s age-verification enforcement, suggesting that restricting VPN access to adults may be necessary.
The evidence does not clearly support that conclusion.
A 2023 University of Michigan study - the first large-scale survey of VPN users and providers - interviewed 1,252 VPN users in the United States and nine providers. It found that the main reason people use VPNs is protection against threats and surveillance, not bypassing content restrictions. The community notes attached to the EP briefing make the same point: there is no evidence that bypassing age verification is a primary VPN use case.
When regulators treat a general privacy tool as a specific harm vector, the resulting policies often exceed the problem they claim to address.
The briefing’s proposed solution - age-verifying VPN access - illustrates this. To enforce age restrictions, providers would need to collect verified identity data from all users. That directly conflicts with the core reason many people use VPNs: avoiding the creation of identifiable records tied to their internet activity. The policy would effectively dismantle the trust model VPNs rely on.
The briefing also acknowledges, but does not fully address, a structural issue with VPNs themselves. University of Michigan researchers showed that network providers and censors can fingerprint more than 85% of OpenVPN traffic, the most widely used VPN protocol. VPNs route traffic through centralized provider infrastructure, shifting trust from the ISP to the VPN operator rather than removing the observation surface altogether. Under age-verification rules, regulated VPN providers become even more concentrated and legally accessible points of data collection.
Mandatory age assurance, increased platform liability, and content-blocking obligations create a pattern in which identifiable privacy tools become both more burdensome to use and structurally weaker.
VPN architecture was not designed for this regulatory environment. It centralizes routing, exposes provider relationships, and depends on the legal integrity of a third party.
Enigma’s Enhanced Private Network (EPN) addresses some of these weaknesses at the architectural level. Instead of centralized server routing, EPN uses a distributed relay design. Traffic is not tied to a single provider endpoint, and routing is separated from identity at the protocol level, reducing stable observation points for both network analysis and regulatory access requests.
$ENX
Data Tunnels: Authenticated, Ephemeral Connectivity
Standard network services are discoverable by default - exposed endpoints are enumerable without prior authentication. RAVID data tunnels operate differently: no network path exists until identity and authorization have been verified.
Tunnel establishment follows a fixed sequence: identity authentication, policy authorization, epoch-based route calculation, ECDH session key derivation, and encrypted channel creation. No step is reachable without the preceding one completing successfully.
Routes are not fixed. They are recalculated per epoch and may change across epoch boundaries. Session keys and paths rotate without terminating active sessions, providing forward secrecy without availability interruption.
The practical result is that RAVID services carry no persistent, scannable network presence. There are no exposed IPs or ports prior to authentication — reducing the observation surface associated with perimeter-based access models.
$ENX
Future Challenges - Solved Today 🧵
1/ Capital markets are moving onchain. Tokenized real-world assets reached $33.9B by mid-2025 - up 380% in three years. Tokenized U.S. money market funds alone exceeded $8.7B. Over 120 banks now offer live crypto services. Institutional exposure to digital assets is now structural.
7/ The architecture serves both individual and institutional use cases. For individuals: reduced cross-session correlation and metadata exposure during communication. For institutions: private connectivity that doesn't rely on fixed infrastructure or centralized relay trust.